Privacy Policy

This privacy notice describes how Lokcube (hereinafter "Lokcube", "we") collects, uses and protects the personal data of users of the website and the services offered, in accordance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree (D.Lgs.) 196/2003, as amended.

1. Data controller

The controller of personal data is:

• Company name: [RAGIONE SOCIALE]
• Registered office: [INDIRIZZO SEDE LEGALE]
• VAT number: [P.IVA]
• Tax code: [CODICE FISCALE]
• Privacy contact email: [email protected]
• General contact email: [email protected]

The Data Protection Officer (DPO), where appointed, can be contacted at [email protected].

2. Categories of data collected

Lokcube collects different categories of personal data depending on its relationship with the user:

2.1 Data voluntarily provided by the user

• Email address or phone number — provided only if the user chooses to register for the service or receive communications;
• Payment data — handled directly by our provider Stripe (PCI DSS); Lokcube does not store card details;
• Contact details for commercial enquiries, partnerships or support.

2.2 Data collected automatically

• Booking ID — an anonymous identifier associated with the compartment used;
• Technical logs — IP address, browser, operating system and timestamp, for security and diagnostic purposes;
• Opening history — a record of openings of the booked compartment, retained for a maximum of 90 days;
• Browsing data — pages visited and events on the website, exclusively in aggregated and anonymous form.

2.3 Biometric data

Lokcube uses the WebAuthn / passkey standard for biometric authentication (FaceID, TouchID, Android fingerprint, Windows Hello). Biometric data (face, fingerprint) never leaves the user's device: it is stored in the Secure Enclave of the phone or computer. Lokcube receives only an encrypted confirmation signed by the device, confirming successful authentication.

3. Purposes and legal bases of processing

4. How data is processed

Data is processed using electronic tools, with appropriate technical and organisational security measures, including:

• Transmission protected end to end by the TLS 1.3 protocol;
• Data at rest encrypted using standard algorithms (AES-256);
• Data access restricted to authorised personnel and logged;
• Regular encrypted backups;
• Continuous monitoring for intrusion detection;
• Password policy and two-factor authentication for all administrative access.

5. Retention period

• Booking data and opening history: 90 days, followed by automatic deletion;
• User email address/phone number: until consent is withdrawn or deletion is requested;
• Tax and accounting data: 10 years as required by Italian tax law;
• Technical logs: 30 days;
• Data relating to B2B contracts with venue partners: for the term of the contract + 10 years.

6. Data recipients

Data may be disclosed to the following recipients, acting as processors or independent controllers:

• Stripe Payments Europe Ltd. — payment processing (Ireland, PCI DSS compliance);
• Railway Corp. — application infrastructure hosting (EU data centre — Frankfurt);
• Transactional email provider for sending receipts and service communications;
• Venue partners — limited to the operational data necessary to manage the locker unit at their premises;
• Competent authorities where required by law or in response to justified requests.

The complete and up-to-date list of processors is available on request at [email protected].

7. Transfers of data outside the EU

Data is mainly processed within the European Union (Railway data centre, Frankfurt). Any transfers outside the EU take place exclusively to countries that ensure an adequate level of protection according to decisions of the European Commission, or on the basis of Standard Contractual Clauses (SCC) approved by the European Commission.

8. Data subject rights

Under Articles 15-22 of the GDPR, the user has the right to:

• Access their personal data (Art. 15);
• Rectification of inaccurate or incomplete data (Art. 16);
• Erasure ("right to be forgotten", Art. 17) — available with 1 click directly in the app;
• Restriction of processing (Art. 18);
• Data portability in a structured and readable format (Art. 20);
• Object to processing based on legitimate interest or for marketing (Art. 21);
• Withdraw consent at any time, without affecting the lawfulness of prior processing;
• Lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (garanteprivacy.it).

Requests may be sent to [email protected]. Lokcube responds within 30 days of receiving the request.

9. Biometric data and WebAuthn

The biometric authentication used by Lokcube is based on the WebAuthn (W3C) standard, which ensures by design that:

• Biometric data (face, fingerprint) is never transmitted to Lokcube or third parties;
• Data remains stored exclusively in the Secure Enclave / TPM of the user's device;
• Lokcube receives only an encrypted confirmation signed by the device: "this user is authenticated";
• The associated passkey may be revoked by the user at any time through the device or app settings.

10. Cookie Policy

The Lokcube website uses technical cookies necessary for the service to function and, only with prior explicit consent, third-party analytics cookies (see § 10.2). No profiling or tracking cookies are used without the user's explicit consent.

10.1 Technical cookies (necessary)

• User preferences — storage of cookie consent and the chosen language (localStorage closet_cookie_consent and lokcube_language);
• Session — temporary authentication token while using the app.

Legal basis: legitimate interest (Art. 6.1.f GDPR); consent is not required.

10.2 Analytics cookies (optional, with prior consent)

With prior explicit consent given through the cookie banner ("Accept all"), the website uses Google Analytics 4 for aggregated statistics on website use. Without consent, these cookies are not installed and no data is sent to Google.

• _ga, _ga_87S7E1QHHP — Google Analytics, statistical purposes, duration of up to 24 months;
• Third-party controller: Google Ireland Ltd. Data may be transferred outside the EU (USA) with the safeguards of the Data Privacy Framework and Standard Contractual Clauses. Privacy policy: policies.google.com/privacy.

The IP address is collected in anonymised form (anonymize_ip). Consent can be withdrawn at any time through "Manage cookies".

10.3 How to manage cookies

The user may change their preferences at any time:

• By clicking "Manage cookies" at the bottom of any page;
• By deleting their browser's browsing data;
• By changing the browser's cookie settings (disabling technical cookies may affect the functioning of the website).

11. Minors

Lokcube services are not intended for children under 16. Lokcube does not knowingly collect personal data from minors. If a parent or guardian believes that a minor has provided personal data without consent, they may request its deletion by contacting [email protected].

12. Changes to this privacy notice

Lokcube reserves the right to amend this Privacy Policy at any time. Registered users will be notified of substantial changes by email, and the changes will be announced on the website with at least 30 days' notice. The last updated date is shown at the top of this document.

13. Contact

For any questions concerning the processing of personal data, please contact:

• Privacy email: [email protected]
• DPO email: [email protected]
• Certified email (PEC): [PEC]
• Postal address: [INDIRIZZO SEDE LEGALE]